diff options
Diffstat (limited to 'stack/btm/btm_acl.cc')
| -rw-r--r-- | stack/btm/btm_acl.cc | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/stack/btm/btm_acl.cc b/stack/btm/btm_acl.cc index 868a2a440..8f8e49794 100644 --- a/stack/btm/btm_acl.cc +++ b/stack/btm/btm_acl.cc @@ -50,6 +50,7 @@ #include "device/include/interop.h" #include "hcidefs.h" #include "hcimsgs.h" +#include "log/log.h" #include "l2c_int.h" #include "osi/include/log.h" #include "osi/include/osi.h" @@ -1084,7 +1085,7 @@ void btm_read_remote_features_complete(uint8_t* p) { * Returns void * ******************************************************************************/ -void btm_read_remote_ext_features_complete(uint8_t* p) { +void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) { tACL_CONN* p_acl_cb; uint8_t page_num, max_page; uint16_t handle; @@ -1092,6 +1093,14 @@ void btm_read_remote_ext_features_complete(uint8_t* p) { BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete"); + if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) { + android_errorWriteLog(0x534e4554, "141552859"); + BTM_TRACE_ERROR( + "btm_read_remote_ext_features_complete evt length too short. length=%d", + evt_len); + return; + } + ++p; STREAM_TO_UINT16(handle, p); STREAM_TO_UINT8(page_num, p); @@ -1111,6 +1120,13 @@ void btm_read_remote_ext_features_complete(uint8_t* p) { return; } + if (page_num > max_page) { + android_errorWriteLog(0x534e4554, "141552859"); + BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid", + page_num); + return; + } + p_acl_cb = &btm_cb.acl_db[acl_idx]; /* Copy the received features page */ |